Skip to content

Commit db78756

Browse files
terrancedejesusDefSecSentinel
terrancedejesus
and
DefSecSentinel
authored
[New Rule] Adding Coverage for DynamoDB Exfiltration Behaviors (#4535)
* new rules for AWS DynamoDB data exfiltration * bumping patch version * adjusting investigation guide * updating patch version * updating patch version * updating patch version --------- Co-authored-by: Colson Wilhoit <[email protected]>
1 parent 75b2b5c commit db78756

File tree

4 files changed

+261
-2
lines changed

4 files changed

+261
-2
lines changed

‎detection_rules/etc/non-ecs-schema.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,11 @@
164164
"aws.cloudtrail.flattened.request_parameters.key": "keyword",
165165
"aws.cloudtrail.flattened.request_parameters.includeDeprecated": "keyword",
166166
"aws.cloudtrail.flattened.request_parameters.withDecryption": "boolean",
167-
"aws.cloudtrail.flattened.request_parameters.instanceId": "keyword"
167+
"aws.cloudtrail.flattened.request_parameters.instanceId": "keyword",
168+
"aws.cloudtrail.flattened.request_parameters.dryRun": "boolean",
169+
"aws.cloudtrail.flattened.request_parameters.clientToken": "keyword",
170+
"aws.cloudtrail.flattened.response_elements.s3BucketName": "keyword",
171+
"aws.cloudtrail.flattened.response_elements.tableArn": "keyword"
168172
},
169173
"logs-azure.signinlogs-*": {
170174
"azure.signinlogs.properties.conditional_access_audiences.application_id": "keyword",

‎pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[project]
22
name = "detection_rules"
3-
version = "0.4.25"
3+
version = "0.4.26"
44
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
55
readme = "README.md"
66
requires-python = ">=3.12"

‎rules/integrations/aws/exfiltration_dynamodb_scan_by_unusual_user.toml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
[metadata]
2+
creation_date = "2025/03/13"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2025/03/13"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may
11+
use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects
12+
unusual user activity by monitoring for the Scan action in CloudTrail logs. This is a New Terms rule that only flags
13+
when this behavior is observed by the `aws.cloudtrail.user_identity.arn` for the first time in the last 14 days.
14+
"""
15+
false_positives = [
16+
"""
17+
Legitimate users may scan DynamoDB tables for various reasons, such as data analysis or application functionality.
18+
Ensure that the user has the necessary permissions and that the Scan operation is authorized before taking action.
19+
""",
20+
]
21+
from = "now-9m"
22+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
23+
language = "kuery"
24+
license = "Elastic License v2"
25+
name = "AWS DynamoDB Scan by Unusual User"
26+
note = """## Triage and analysis
27+
28+
### Investigating AWS DynamoDB Scan by Unusual User
29+
30+
This rule identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the Scan action in CloudTrail logs.
31+
32+
This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule that only flags when this behavior is observed for the first time on a host in the last 14 days.
33+
34+
#### Possible Investigation Steps
35+
36+
- Identify the Actor: Review the `aws.cloudtrail.user_identity.arn` field to identify the user who requested the subscription. Verify if this actor typically performs such actions and has the necessary permissions. It may be unusual for this activity to originate from certain user types, such as an assumed role or federated user.
37+
- Review the Source IP: Check the `source.address` field to determine the source of the request. If the request comes from an unexpected location or IP address, it may indicate a compromised account or unauthorized access.
38+
- Analyze the Request Parameters: Examine the `aws.cloudtrail.request_parameters` field to understand the details of the Scan request. Look for any unusual parameters or patterns that may indicate malicious intent. This also details the DynamoDB table being scanned.
39+
- Review Access Key: Check the `aws.cloudtrail.user_identity.access_key_id` field to identify the access key used for the request. Determine if this key is associated with a legitimate user or if it has been compromised.
40+
41+
42+
### False Positive Analysis
43+
44+
- Historical User Actions: If the user has a history of scanning DynamoDB tables for legitimate purposes, this may not be a false positive. Review the user's activity logs to determine if this behavior is consistent with their normal actions.
45+
- Automated Processes: Some automated processes or applications may perform scans on DynamoDB tables as part of their functionality. If the user is associated with such a process, this may not be a false positive.
46+
47+
### Response and Remediation
48+
49+
- Immediate Review and Reversal: If the Scan action is determined to be unauthorized, immediately revoke the user's access to the DynamoDB table and any associated resources. This may involve disabling the user's account or removing their permissions.
50+
- Investigate Compromise: If the Scan action is determined to be malicious, investigate the source of the request and any potential compromise of the user's account. This may involve reviewing access logs, resetting passwords, and enabling multi-factor authentication (MFA) for the affected user. If export options were used with the CLI or SDK, they may have been saved locally or to a remote location.
51+
- Review IAM Policies: Review the IAM policies associated with the user to ensure that they have the appropriate permissions for their role. If necessary, update the policies to restrict access to sensitive resources.
52+
- Monitor for Future Activity: Continue to monitor the user's activity for any further suspicious behavior. Set up additional alerts or logging to detect any future unauthorized access attempts.
53+
54+
### Additional Information
55+
56+
For further guidance on managing and securing SNS topics in AWS environments, refer to the [AWS SNS documentation](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/security.html) and AWS best practices for security.
57+
"""
58+
references = ["https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Scan.html"]
59+
risk_score = 21
60+
rule_id = "96b2a03e-003b-11f0-8541-f661ea17fbcd"
61+
setup = "DynamoDB data events must be enabled in CloudTrail to capture the Scan action. Ensure that the AWS CloudTrail service is configured to log data events for DynamoDB tables."
62+
severity = "low"
63+
tags = [
64+
"Domain: Cloud",
65+
"Data Source: AWS",
66+
"Data Source: Amazon Web Services",
67+
"Data Source: AWS DynamoDB",
68+
"Resources: Investigation Guide",
69+
"Use Case: Threat Detection",
70+
"Tactic: Exfiltration",
71+
]
72+
timestamp_override = "event.ingested"
73+
type = "new_terms"
74+
75+
query = '''
76+
event.dataset: "aws.cloudtrail"
77+
and event.provider: "dynamodb.amazonaws.com"
78+
and event.action: "Scan"
79+
and event.outcome: "success"
80+
'''
81+
82+
83+
[[rule.threat]]
84+
framework = "MITRE ATT&CK"
85+
[[rule.threat.technique]]
86+
id = "T1567"
87+
name = "Exfiltration Over Web Service"
88+
reference = "https://attack.mitre.org/techniques/T1567/"
89+
90+
91+
[rule.threat.tactic]
92+
id = "TA0010"
93+
name = "Exfiltration"
94+
reference = "https://attack.mitre.org/tactics/TA0010/"
95+
[[rule.threat]]
96+
framework = "MITRE ATT&CK"
97+
[[rule.threat.technique]]
98+
id = "T1530"
99+
name = "Data from Cloud Storage"
100+
reference = "https://attack.mitre.org/techniques/T1530/"
101+
102+
103+
[rule.threat.tactic]
104+
id = "TA0009"
105+
name = "Collection"
106+
reference = "https://attack.mitre.org/tactics/TA0009/"
107+
108+
[rule.investigation_fields]
109+
field_names = [
110+
"@timestamp",
111+
"user.name",
112+
"source.address",
113+
"aws.cloudtrail.user_identity.arn",
114+
"aws.cloudtrail.user_identity.type",
115+
"aws.cloudtrail.user_identity.access_key_id",
116+
"user_agent.original",
117+
"event.action",
118+
"event.outcome",
119+
"cloud.region",
120+
"aws.cloudtrail.flattened.request_parameters.tableName",
121+
"aws.cloudtrail.flattened.response_elements.subscriptionArn",
122+
"aws.cloudtrail.request_parameters",
123+
]
124+
125+
[rule.new_terms]
126+
field = "new_terms_fields"
127+
value = ["aws.cloudtrail.user_identity.arn"]
128+
[[rule.new_terms.history_window_start]]
129+
field = "history_window_start"
130+
value = "now-14d"
131+
132+

‎rules/integrations/aws/exfiltration_dynamodb_table_exported_to_s3.toml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
[metadata]
2+
creation_date = "2025/03/13"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2025/03/13"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the ExportTableToPointInTime operation to
11+
collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by
12+
monitoring for the ExportTableToPointInTime action in CloudTrail logs. This is a New Terms rule that only flags when
13+
this behavior is observed by the `aws.cloudtrail.user_identity.arn` for the first time in the last 14 days.
14+
"""
15+
false_positives = [
16+
"""
17+
Legitimate users may export DynamoDB tables for various reasons, such as data analysis or backup purposes. Ensure
18+
that the user has the necessary permissions and that the ExportTableToPointInTime operation is authorized before
19+
taking action.
20+
""",
21+
]
22+
from = "now-9m"
23+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
24+
language = "kuery"
25+
license = "Elastic License v2"
26+
name = "AWS DynamoDB Table Exported to S3"
27+
note = """ ## Triage and analysis
28+
29+
### Investigating AWS DynamoDB Table Exported to S3
30+
31+
This rule identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the ExportTableToPointInTime operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the ExportTableToPointInTime action in CloudTrail logs.
32+
33+
This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule that only flags when this behavior is observed for the first time on a host in the last 14 days.
34+
35+
#### Possible Investigation Steps
36+
- Identify the Actor: Review the `aws.cloudtrail.user_identity.arn` field to identify the user who requested the export. Verify if this actor typically performs such actions and has the necessary permissions. It may be unusual for this activity to originate from certain user types, such as an assumed role or federated user.
37+
- Review the Source IP: Check the `source.address` field to determine the source of the request. If the request comes from an unexpected location or IP address, it may indicate a compromised account or unauthorized access.
38+
- Analyze the Request Parameters: Examine the `aws.cloudtrail.request_parameters` field to understand the details of the ExportTableToPointInTime request. Look for any unusual parameters or patterns that may indicate malicious intent. This also details the DynamoDB table being exported.
39+
- Review Access Key: Check the `aws.cloudtrail.user_identity.access_key_id` field to identify the access key used for the request. Determine if this key is associated with a legitimate user or if it has been compromised.
40+
41+
### False Positive Analysis
42+
- Historical User Actions: If the user has a history of exporting DynamoDB tables for legitimate purposes, this may not be a false positive. Review the user's activity logs to determine if this behavior is consistent with their normal actions.
43+
- Automated Processes: Some automated processes or applications may perform exports on DynamoDB tables as part of their functionality. If the user is associated with such a process, this may not be a false positive.
44+
45+
### Response and Remediation
46+
- Immediate Review and Reversal: If the ExportTableToPointInTime action is determined to be unauthorized, immediately revoke the user's access to the DynamoDB table and any associated resources. This may involve disabling the user's account or removing their permissions.
47+
- Investigate Compromise: If the ExportTableToPointInTime action is determined to be malicious, investigate the source and destination of the request and any potential compromise of the user's account. If the destination S3 bucket is not known, it may be a sign of data exfiltration and may require incident response.
48+
- Review IAM Policies: Review the IAM policies associated with the user to ensure that they have the appropriate permissions for their role. If necessary, update the policies to restrict access to sensitive resources.
49+
- Monitor for Future Activity: Continue to monitor the user's activity for any further suspicious behavior. Set up additional alerts or logging to detect any future unauthorized access attempts.
50+
51+
### Additional Information
52+
53+
For further guidance on managing and securing SNS topics in AWS environments, refer to the [AWS SNS documentation](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/security.html) and AWS best practices for security.
54+
"""
55+
references = ["https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExportTableToPointInTime.html"]
56+
risk_score = 21
57+
rule_id = "e8ea6f58-0040-11f0-a243-f661ea17fbcd"
58+
setup = "DynamoDB data events must be enabled in CloudTrail to capture the ExportTableToPointInTime actions. Ensure that the AWS CloudTrail service is configured to log data events for DynamoDB tables."
59+
severity = "low"
60+
tags = [
61+
"Domain: Cloud",
62+
"Data Source: AWS",
63+
"Data Source: Amazon Web Services",
64+
"Data Source: AWS DynamoDB",
65+
"Resources: Investigation Guide",
66+
"Use Case: Threat Detection",
67+
"Tactic: Exfiltration",
68+
]
69+
timestamp_override = "event.ingested"
70+
type = "new_terms"
71+
72+
query = '''
73+
event.dataset: "aws.cloudtrail"
74+
and event.provider: "dynamodb.amazonaws.com"
75+
and event.action: "ExportTableToPointInTime"
76+
and aws.cloudtrail.flattened.request_parameters.dryRun: false
77+
'''
78+
79+
80+
[[rule.threat]]
81+
framework = "MITRE ATT&CK"
82+
[[rule.threat.technique]]
83+
id = "T1567"
84+
name = "Exfiltration Over Web Service"
85+
reference = "https://attack.mitre.org/techniques/T1567/"
86+
[[rule.threat.technique.subtechnique]]
87+
id = "T1567.002"
88+
name = "Exfiltration to Cloud Storage"
89+
reference = "https://attack.mitre.org/techniques/T1567/002/"
90+
91+
92+
93+
[rule.threat.tactic]
94+
id = "TA0010"
95+
name = "Exfiltration"
96+
reference = "https://attack.mitre.org/tactics/TA0010/"
97+
98+
[rule.investigation_fields]
99+
field_names = [
100+
"@timestamp",
101+
"user.name",
102+
"source.address",
103+
"aws.cloudtrail.user_identity.arn",
104+
"aws.cloudtrail.user_identity.type",
105+
"aws.cloudtrail.user_identity.access_key_id",
106+
"user_agent.original",
107+
"event.action",
108+
"event.outcome",
109+
"cloud.region",
110+
"aws.cloudtrail.flattened.request_parameters.clientToken",
111+
"aws.cloudtrail.flattened.response_elements.s3Bucket",
112+
"aws.cloudtrail.flattened.response_elements.tableArn",
113+
"aws.cloudtrail.request_parameters",
114+
]
115+
116+
[rule.new_terms]
117+
field = "new_terms_fields"
118+
value = ["aws.cloudtrail.user_identity.arn"]
119+
[[rule.new_terms.history_window_start]]
120+
field = "history_window_start"
121+
value = "now-14d"
122+
123+

0 commit comments

Comments
 (0)